topic Issues with Dual ISP Failover in General Topics

Issues with Dual ISP Failover

pomologist — Fri, 19 Aug 2022 21:48:11 GMT

I followed these instructions to set up ISP failover : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO

When the primary ISP1 goes down, it does indeed fail over to secondary ISP2, in every respect except that traffic doesn't use ISP2's NAT automatically. Upon failover, traffic continues trying to use the NAT rule associated with ISP1. I have to manually go in and DISABLE ISP1's NAT rule, then traffic starts automatically flowing as expected via the NAT rule that exists for ISP2.

What can I do so that this NAT switch happens automatically upon failover?

Re: Issues with Dual ISP Failover

pomologist — Sun, 21 Aug 2022 15:49:24 GMT

Update:

Here are two screenshots that I hope will make things clearer.

Something bizarre is going on. ISP1 uses Eth1/1 Interface. ISP2 uses Eth1/2 interface. Bizarre thing is that Eth1/1 traffic is NATing through Eth 1/2's NAT rule successfully! See photos. What's going on? HELP!

Re: Issues with Dual ISP Failover

aleksandar.astardzhiev — Mon, 22 Aug 2022 11:34:19 GMT

Hi @pomologist ,

Looking at your screenshot it seems you have missed one key component when configuring the NAT rules - Destination Interface.

NAT rules are evaluated the same way as security rules - first match, top to bottom.

When you configured only source and destination zone for the NAT (using any for source/dest IPs) traffic will always hit the first rule and never reach the second one.

For that reason you must configure "Destination Interface", this will add the egressing interface as part of the matching criteria when evaluating the NAT rules.

So when your primary ISP is up and traffic is using the primary default route your egress/destination interface will be eth1/1 (primary internet).

When primary ISP is down and path monitor "disable" the primary default, traffic will take the backup default, buth this means egress/destination interface will be different, so this traffic will no longer match the first NAT rule and NAT evaluation will keep looking down reaching the second NAT rule.

Hope that make sense

Re: Issues with Dual ISP Failover

pomologist — Mon, 22 Aug 2022 13:39:43 GMT

THANK YOU SO MUCH!!! I don't know how I missed that! Yes of course it makes perfect sense. I so much appreciate you pointing this out.